Blindfold

Blindfold your agents before they wander into your secrets.

Blindfold runs coding agents in an OS-enforced sandbox. You decide which files an agent can read or modify, whether it can access the network, and whether it can see Git history. The restrictions apply to the agent and every process it starts, including shells, test runners, interpreters, and subagents.

Blindfold supports Codex, Claude Code, and OpenCode on Linux (amd64 and arm64). macOS and Windows are not currently supported.

Why Blindfold?

Instructions such as “do not read .env” are not security boundaries. An agent can access the same file through a shell, script, package manager, or another tool. Blindfold uses Bubblewrap to restrict the entire process tree at the operating-system level.

• The host filesystem is read-only by default.
• The project and explicitly allowed paths remain writable.
• Denied paths are inaccessible.
• Network access can be shared or isolated.
• Git history can be visible or hidden.
• Invalid policies and sandbox failures stop the agent from launching.

Use blind explain to inspect the effective sandbox before launch.

Requirements

• Linux
• Bubblewrap 0.11.0 or newer
• Codex, Claude Code, or OpenCode, already installed and configured, when launching a coding agent
• fd (or fdfind) and fzf for the interactive blind init command

The host must allow the unprivileged namespaces required by Bubblewrap. Blindfold does not install or configure coding agents.

The standard blind demo command does not require a coding agent or API key.

Quickstart

For judging, clone this repository and install the published v0.1.0 binary without rebuilding it:

./scripts/install-release.sh v0.1.0
export PATH="$HOME/.local/bin:$PATH"
blind demo

The release installer selects the Linux amd64 or arm64 archive, verifies its SHA-256 checksum, installs blind to ~/.local/bin, and checks the installed version. The demo then creates disposable fake fixtures and exercises the filesystem, network, and Git restrictions without requiring an API key or coding-agent session.

To build and install from a source checkout instead:

./scripts/install.sh
export PATH="$HOME/.local/bin:$PATH"
blind version

The installer checks dependencies and installs Blindfold to ~/.local/bin/blind. To build it directly, use the Go version declared in go.mod:

go build -o blind ./cmd/blind

Create a policy from your project root:

cd /path/to/project
blind init
blind explain

Then launch an agent:

blind codex
blind claude
blind opencode run

Additional arguments pass through to the agent. For example:

blind codex exec "run the focused tests"

Use blind dry-run to print the complete sandbox command without running it.

Policy

Blindfold loads the nearest .blindfold.toml in the current directory or one of its parents. A policy can control networking, Git history, and exact file or directory paths:

version = 1

[settings]
network = "isolated"
git_history = "hidden"

[[paths]]
path = ".env"
access = "deny"
optional = true
reason = "local application credentials"

[[paths]]
path = "docs/reference"
access = "read-only"

[[paths]]
path = "$SHARED_BUILD_CACHE"
access = "read-write"

Settings

Field	Default	Values	Effect
network	"shared"	"shared", "isolated"	Share the host network or create a private network namespace.
git_history	"visible"	"visible", "hidden"	Keep Git metadata available or deny repository history.

Hiding Git history disables commands such as git log and git show inside the sandbox. Mediated Git operations with hidden history are not yet supported.

Path rules

Field	Required	Meaning
path	Yes	File or directory to control.
access	Yes	"deny", "read-only", or "read-write".
optional	No	Skip an absent path with a warning. Defaults to false.
reason	No	Explanation shown by inspection commands.

Relative paths are resolved from the policy directory. Absolute paths, ~, ~/path, and complete environment-variable references such as $CACHE_DIR are supported. Environment variables cannot be embedded in paths, and shell expressions, globs, braces, and command substitution are rejected.

Existing paths are resolved through symlinks. Duplicate targets and rules that make a child more permissive than its parent are rejected. The project root cannot be denied or made read-only, and the active policy is always protected from modification.

Run blind explain [agent] to see resolved paths, skipped optional rules, implicit protections, and final mounts.

Security model and limitations

Blindfold treats the agent and all of its child processes as untrusted. It trusts the host user, the blind binary, the loaded policy, Bubblewrap, and the Linux kernel.

A configured deny rule prevents sandboxed processes from reading, changing, replacing, or traversing that host path. The name and metadata may remain visible. Denial applies to future descendants of a denied directory, but an optional path that does not exist at startup is skipped and must be protected by restarting Blindfold after it is created.

Blindfold does not protect against compromised trusted components, root, secrets copied to another location, remote services with host access, or aliases outside the policy's resolved startup paths. It fails closed when a required path, policy, prerequisite, or sandbox setup is invalid.\

Blindfold rejects denied regular files when known hard-link aliases make the configured path insufficient. It does not protect data that was already copied to a separate filesystem object or location.

Verified demo

Run a disposable sandbox that checks denied, read-only, and writable paths; network isolation; and hidden Git metadata:

blind demo

To run the checks and then open an agent in the same sandbox:

blind demo --codex
blind demo --claude
blind demo --opencode

The fixtures are visibly fake and removed when the command or agent exits. See the expected output in examples/demo-output.txt.

Troubleshooting

• blind is not found: Add $HOME/.local/bin to PATH or use the full path $HOME/.local/bin/blind.
• A dependency is missing: Rerun scripts/install.sh and review the package manager command it displays.
• Namespaces are unavailable: Enable unprivileged user namespaces according to your Linux distribution's security policy. There is no unsandboxed fallback.
• No policy is found: Run blind init at the project root and invoke Blindfold from that directory or a descendant.
• A required path is missing: Correct it or set optional = true when the path is genuinely optional, then check blind explain.
• Git commands fail: Git history is hidden or .git is explicitly denied.
• A denied filename is visible: Denial makes its contents inaccessible; it does not necessarily hide the name or metadata.

Roadmap

• Domain-level network allowlisting and audit logs
• Mediated Git operations while history remains hidden
• macOS sandbox backend

OpenAI Build Week 2026

Blindfold is a Developer Tools submission for OpenAI Build Week 2026. The repository was created on July 18, 2026, during the July 13–21 submission period; the dated commit history records the project from its initial setup through the verified Linux release.

How Codex and GPT-5.6 contributed

Blindfold was implemented primarily through Codex, powered by GPT-5.6. Codex accelerated the path from an initial security idea to a reviewable threat model, implementation plan, and working Go CLI. It helped trace Bubblewrap's mount and process boundaries, implement policy parsing and sandbox planning, and iterate on failures found by unit and Linux integration tests.

Codex also helped extend the core boundary into a usable product: interactive policy setup, explain and dry-run inspection, adapters for Codex, Claude Code, and OpenCode, installers, release packaging, the disposable verified demo, and user documentation. GPT-5.6 was especially useful for carrying security constraints across those layers and reviewing whether the tests proved the documented behavior rather than merely exercising code paths.

Product and engineering decisions

I made the key decisions that define the project: enforce access at the operating-system boundary instead of trusting prompts; keep the live project writable while making the rest of the host read-only by default; apply restrictions to the agent's complete local process tree; and fail closed rather than fall back to an unsandboxed launch. I also chose the exact-path policy model, Linux and Bubblewrap as the first supported platform, the user-facing CLI workflow, and the documented limits of the security claim.

Suggestions from Codex were accepted only after inspection against those decisions and verification with focused tests. Evidence available to judges includes the public commit history, CI workflow, recorded demo output, published checksummed Linux binaries, and the blind demo test path above. The required /feedback Codex Session ID is provided with the Devpost submission.

License

Blindfold is available under the MIT License. Dependency licenses and the Bubblewrap acknowledgement are listed in THIRD_PARTY_NOTICES.md.